a7y18lte-ubports/android_kernel_samsung_a7y18lte
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
454544d95f
android_kernel_samsung_a7y1.../fs
History
Chao Yu a8dc9be10c f2fs: fix to do sanity check on segment bitmap of LFS curseg 
[ Upstream commit c854f4d681365498f53ba07843a16423625aa7e9 ]

As Jungyeon Reported in bugzilla:

https://bugzilla.kernel.org/show_bug.cgi?id=203233

- Reproduces
gcc poc_13.c
./run.sh f2fs

- Kernel messages
 F2FS-fs (sdb): Bitmap was wrongly set, blk:4608
 kernel BUG at fs/f2fs/segment.c:2133!
 RIP: 0010:update_sit_entry+0x35d/0x3e0
 Call Trace:
  f2fs_allocate_data_block+0x16c/0x5a0
  do_write_page+0x57/0x100
  f2fs_do_write_node_page+0x33/0xa0
  __write_node_page+0x270/0x4e0
  f2fs_sync_node_pages+0x5df/0x670
  f2fs_write_checkpoint+0x364/0x13a0
  f2fs_sync_fs+0xa3/0x130
  f2fs_do_sync_file+0x1a6/0x810
  do_fsync+0x33/0x60
  __x64_sys_fsync+0xb/0x10
  do_syscall_64+0x43/0x110
  entry_SYSCALL_64_after_hwframe+0x44/0xa9

The testcase fails because that, in fuzzed image, current segment was
allocated with LFS type, its .next_blkoff should point to an unused
block address, but actually, its bitmap shows it's not. So during
allocation, f2fs crash when setting bitmap.

Introducing sanity_check_curseg() to check such inconsistence of
current in-used segment.

Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-04-07 07:36:58 +02:00
..
9p 9p: pass the correct prototype to read_cache_page 2020-04-06 20:16:23 +02:00
adfs fs/adfs: super: fix use-after-free bug 2020-04-06 20:26:54 +02:00
affs A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
afs A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
autofs4 A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
befs A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
bfs A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
btrfs Btrfs: fix assertion failure during fsync and use of stale transaction 2020-04-06 21:35:33 +02:00
cachefiles A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
ceph ceph: fix buffer free while holding i_ceph_lock in __ceph_setxattr() 2020-04-06 21:34:27 +02:00
cifs cifs: Use kzfree() to zero out the password 2020-04-06 21:36:55 +02:00
coda coda: add error handling for fget 2020-04-06 20:27:22 +02:00
configfs A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
cramfs A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
crypto A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
debugfs debugfs: fix use-after-free on symlink traversal 2020-04-06 16:42:15 +02:00
devpts A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
dlm A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
ecryptfs eCryptfs: fix a couple type promotion bugs 2020-04-06 20:04:55 +02:00
efivarfs A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
efs A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
exofs A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
exportfs A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
ext2 A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
ext4 fscrypt: don't set policy for a dead directory 2020-04-06 19:29:02 +02:00
f2fs f2fs: fix to do sanity check on segment bitmap of LFS curseg 2020-04-07 07:36:58 +02:00
fat fs/fat/file.c: issue flush after the writeback of FAT 2020-04-06 19:00:52 +02:00
freevxfs A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
fscache A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
fuse fuse: retrieve: cap requested size to negotiated max_write 2020-04-06 19:02:05 +02:00
gfs2 GFS2: don't set rgrp gl_object until it's inserted into rgrp tree 2020-04-06 21:11:07 +02:00
hfs A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
hfsplus A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
hostfs A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
hpfs A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
hugetlbfs hugetlb: use same fault hash key for shared and private mappings 2020-04-06 18:15:12 +02:00
isofs A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
jbd2 A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
jffs2 jffs2: fix use-after-free on symlink traversal 2020-04-06 16:42:13 +02:00
jfs A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
kernfs A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
lockd A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
logfs A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
minix A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
ncpfs A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
nfs NFSv2: Fix write regression 2020-04-06 21:36:50 +02:00
nfs_common A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
nfsd nfsd: Fix overflow causing non-working mounts on 1 TB machines 2020-04-06 20:05:44 +02:00
nilfs2 A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
nls A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
notify A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
ntfs A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
ocfs2 ocfs2: remove set but not used variable 'last_hash' 2020-04-06 20:49:16 +02:00
omfs A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
openpromfs A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
overlayfs ovl: modify ovl_permission() to do checks on two inodes 2020-04-06 19:17:17 +02:00
proc Revert "coredump: fix race condition between mmget_not_zero()/get_task_mm() and core dumping" 2020-04-06 22:47:46 +05:30
pstore A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
qnx4 A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
qnx6 A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
quota A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
ramfs A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
reiserfs A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
romfs A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
sdcardfs A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
sdfat A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
squashfs A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
sysfs A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
sysv A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
tracefs A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
ubifs A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
udf udf: Fix incorrect final NOT_ALLOCATED (hole) extent length 2020-04-06 19:26:24 +02:00
ufs ufs: fix braino in ufs_get_inode_gid() for solaris UFS flavour 2020-04-06 18:14:41 +02:00
xfs A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
aio.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
anon_inodes.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
attr.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
bad_inode.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
binfmt_aout.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
binfmt_elf_fdpic.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
binfmt_elf.c binfmt_elf: switch to new creds when switching to new mm 2020-04-06 14:52:46 +02:00
binfmt_em86.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
binfmt_flat.c fs/binfmt_flat.c: make load_flat_shared_library() work 2020-04-06 19:13:44 +02:00
binfmt_misc.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
binfmt_script.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
block_dev.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
buffer.c fs: fix guard_bio_eod to check for real EOD errors 2020-04-06 14:50:20 +02:00
char_dev.c chardev: add additional check for minor range overlap 2020-04-06 18:19:58 +02:00
compat_binfmt_elf.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
compat_ioctl.c compat_ioctl: pppoe: fix PPPOEIOCSFWD handling 2020-04-06 20:28:29 +02:00
compat.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
coredump.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
dax.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
dcache.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
dcookies.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
direct-io.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
dlog_hook.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
drop_caches.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
eventfd.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
eventpoll.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
exec.c sched/fair: Don't free p->numa_faults with concurrent readers 2020-04-06 20:26:24 +02:00
fcntl.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
fhandle.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
file_table.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
file.c fs/file.c: initialize init_files.resize_wait 2020-04-06 14:49:46 +02:00
filesystems.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
fs_pin.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
fs_struct.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
fs-writeback.c fs/writeback.c: use rcu_barrier() to wait for inflight wb switches going into workqueue when umount 2020-04-06 18:12:59 +02:00
inode.c Abort file_remove_privs() for non-reg. files 2020-04-06 19:09:43 +02:00
internal.h A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
ioctl.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
Kconfig A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
Kconfig.binfmt A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
libfs.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
locks.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
Makefile A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
mbcache.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
mount.h A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
mpage.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
namei.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
namespace.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
no-block.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
nsfs.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
open.c access: avoid the RCU grace period for the temporary subjective credentials 2020-04-06 20:24:58 +02:00
pipe.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
pnode.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
pnode.h A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
posix_acl.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
proc_namespace.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
read_write.c fs: stream_open - opener for stream-like files so that read and write can run simultaneously without deadlock 2020-04-06 18:47:45 +02:00
readdir.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
select.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
seq_file.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
signalfd.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
splice.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
stack.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
stat.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
statfs.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
super.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
sync.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
timerfd.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
userfaultfd.c userfaultfd_release: always remove uffd flags and clear vm_userfaultfd_ctx 2020-04-06 21:09:04 +02:00
utimes.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
xattr.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30